Exploit Toolkit Website 33 Attack

Yeah, apparently the server techs were overly optimistic about their efforts. My programmer pretty much has proven the insertion of malicious code is at the Apache level on the server, but he'd having a tough time convincing the server techs of it. So I've contracted with a third party server security outfit to take a look at it. Just as soon as I can get the current server techs the heck out of the server so I don't have too many people stirring the pot on this stew.

Interestingly enough part of the proof my programmer found as evidence is the reason that I was seeing these redirects on my CorvetteFlorida.com website. I have a link over there from my FaunaAds.com advertising script and apparently when viewers on that site were supposed to be presented with a banner image, the malicious script instead inserted a redirect to the porn site. When he removed the banner ad link, the problem stopped over there. So that's why he believes the insertion is at the Apache level. He was monitoring the handshaking of commands, and it's Apache that is doing the sleight of hand by issuing a redirect to another site instead of a direct issuance of the desired page or page element.

Yeah, he's pretty damned good at what he does. But we still need someone with expertise beyond his to really ferret out the problem.

So it should be SOON. Thanks for your patience as we deal with this.

Just followed the email alert link to a new post in the Hell thread and went straight to a porn site.

It's OK if I follow my own bookmarked link to the Boas discussion forum though. Good luck with this, it's obviously not a simple one.

Has anyone here thought about temporarily disabling outbound links to protect users with servers and sites that may be linked. It seems pretty significant security risk to allow outbound links that are hijacked on the server level. I dont want to have to delete my account here, but if I have to in order to protect my own sites and servers then so be it. Some more promising feedback would be nice.
Thanks
Bill

Expect some downtime here in the very near future. I'm either going to have the current server completely wiped or else just get another server and move the sites to it. In either event, obviously everything will be shut down. I will give as much warning as I can about when this takes place.

It may not help at all, but for what it is worth I am only getting Adult Friend Finder redirects when I see the Hyatt banner ad.

All indications are that the server itself has been hacked into, and this has nothing at all to do with external calls to Google ads.

I have contracted a third party server security company to take a look and give me an assessment of the damages. So the road might get kind of bumpy for a while.

Did not get re directed this morning when I came here.

It seems like the first time I log on each day I get a re-direct... After that first log on, nothing happens...

I also noticed that this ONLY started the moment my "contributing member" status expired... I wonder if it has something to do with that...

Originally Posted by ReptileJay

It seems like the first time I log on each day I get a re-direct... After that first log on, nothing happens...

I also noticed that this ONLY started the moment my "contributing member" status expired... I wonder if it has something to do with that...

I don't see how it could be. And it wouldn't take more than a couple of seconds for you to note that many people engaged in this thread are contributing members.

Originally Posted by ReptileJay

I also noticed that this ONLY started the moment my "contributing member" status expired... I wonder if it has something to do with that...

So, you're saying this is all your fault?? If so, the right thing to do is fix it.

(On a more serious note, this is happening to people at every membership level)